Cloud

Study: Simulated Attacks Uncover Real-World Problems in IT Security

Some 70% of simulated attacks on real networks were able to move laterally within the network, while more than half infiltrated the perimeter and exfiltrated data.

Organizations continue to focus on protecting the perimeter while neglecting to monitor bad guys getting inside and ultimately pilfering data, says a security researcher at SafeBreach, which released a new report today.

In 3,400 breach methods used for 11.5 million attack simulations, SafeBreach in its new Hacker's Playbook Findings Report found that virtual attackers had a more than a 60% success rate of using malware to infiltrate networks. And once in, the malware could move laterally roughly 70% of the time. In half the cases, they could exit networks with data, according to simulated attacks SafeBreach conducted on its customers.

"The most surprising thing is that there is so much focus on the hard-candy shell of the perimeter without paying enough attention to the soft, squishy middle," says Chris Webber, a security strategist at SafeBreach. "It is not that hard to get past the perimeter and once the attacker is in, it is really easy to move around laterally and then exfiltrate out." 

Webber points to the amount of money and solutions he has seen customers pour into protecting the perimeter, yet the majority of simulated malware attacks were still able to move around and steal information.

When it comes to malware infiltration methods, the research found nesting, or "packing," malware executables fooled security controllers more than 50% of the time. For example, packed executables inside JavaScript had a 60.9% success rate of infiltrating a network, while an executable inside a VBScript (VBS) using HTTP managed to make it in 56.5%, and an executable inside a compiled HTML file format (CHM) extension had a 55.9% success rate.

But WannaCry 2.0's method of exploiting a server message block (SMB) vulnerability in Windows achieved a 63.4% success rate in simulated attacks SafeBreach performed, pushing it to the top of successful infiltration methods.

Financial malware Carbanak, which relies on Google's App Script, Sheets, and Forms cloud-based services to communicate its malware commands, also ranked among the top five infiltration methods used in the study. 

"So, in the case of Carbanak, the infiltration 'move' we highlighted was indeed the transfer of the specific Carbanak malware file via HTTP," Webber says. "This could be stopped, for example, by network controllers configured to scan for malicious files and block them before they make their way to the endpoints/hosts for installation to disk."

Concerns over lateral movement appear to be overlooked by a number of organizations, says Webber.

"Folks are focused on keeping things out and not worrying about the other phases of the kill chain," Webber says.

That approach could be a problem, the report notes, given Petya and EternalRocks were both identified as having worm-burrowing capabilities that could move laterally in the network.

Data exfiltration is the last hurdle cyberthieves face, and they usually opt for the easiest method of stealing data, the report found. Traditional clear or encrypted Web traffic, or traditional Web ports, are the preferred method for attackers to exit the network with their cache of data, according to the report.

"A lot of outbound traffic is making its way out through Port 443 (HTTPS) and Port 123 (NTP)," Webber says. "They are pumping out all of your data past your controls by stuffing the data into encrypted packets that look like packets for things like keeping time on your computer and sending it out over NTP [Network Time Protocal]."

Port 123 had a 63.1% exfiltration success rate and Port 443 had 53.7%, according to the report.

Fixing the Links

Webber says it is not enough to try to stop attackers from breaking into the network, nor is it adequate to try to box them in by preventing their entry and exit. Paying attention to lateral moves within the network is also important, he notes.

However, organizations face limited resources. "It comes down to understanding each company. If you have a ton of credit card data, then you spend all the more time from preventing them from exiting the network. But if you have a manufacturing company, then you are more concerned about getting hit with a ransomware attack that can stop your operations. You would probably care more about internal segmentation to prevent worms from moving across your system," he says.

He adds that the best moves companies can take to secure their systems is to optimize their current security solutions, constantly update the configurations as needed, and then test the changes they make.

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Free Tool Scans for Chrome Extension Safety
Dark Reading Staff 2/21/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6485
PUBLISHED: 2019-02-22
Citrix NetScaler Gateway 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5 before build 69.5 and Application Delivery Controller (ADC) 12.1 before build 50.31, 12.0 before build 60.9, 11.1 before build 60.14, 11.0 before build 72.17, and 10.5...
CVE-2019-9020
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpc_decode() can lead to an invalid memory access (heap out of bounds read or read after free). This is related to xml_elem_parse_buf in ext/xmlrpc/libxmlrpc...
CVE-2019-9021
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A heap-based buffer over-read in PHAR reading functions in the PHAR extension may allow an attacker to read allocated or unallocated memory past the actual data when trying to parse the file...
CVE-2019-9022
PUBLISHED: 2019-02-22
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dns_get_record misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects php_parser...
CVE-2019-9023
PUBLISHED: 2019-02-22
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. A number of heap-based buffer over-read instances are present in mbstring regular expression functions when supplied with invalid multibyte data. These occur in ext/mbstring/oniguruma/regcom...